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We live in a modern world supported by large, complex networks. Examples range from financial markets 
to communication and transportation systems. In many realistic situations the flow of physical quantities in the 
network, as characterized by the loads on nodes, is important. We show that for such networks where loads can 
redistribute among the nodes, intentional attacks can lead to a cascade of overload failures, which can in turn 
cause the entire or a substantial part of the network to collapse. This is relevant for real-world networks that 
possess a highly heterogeneous distribution of loads, such as the Internet and power grids. We demonstrate that 
the heterogeneity of these networks makes them particularly vulnerable to attacks in that a large-scale cascade 
may be triggered by disabling a single key node. This brings obvious concerns on the security of such systems. 
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Complex networks are an essential part of a modern soci- 
ety CI 01 ■ It has been shown that many networks, such as the 
world-wide web (WWW), the Internet, and electrical power 
grids, present a surprisingly small average distance between 
nodes and a highly organized distribution of links per node 
Ullll. Generally, the average distance will not be affected 
by the removal of a random subset of nodes, but it will in- 
crease significantly if the removed nodes are among the most 
connected ones |3] (see also Refs. oBSl)- The existence of 
a giant connected component in the network, however, does 
not depend on the presence of highly connected nodes. For 
instance, the WWW has homepages with many thousands of 
hyperlinks and can remain well connected after the removal of 
all homepages with five or more hyperlinks |9]. In addition, 
the giant component itself is typically a small-world network 
fToll even after the removal of all highly connected nodes 1 1 1 ]. 
These pioneering studies on network security address mainly 
static properties, i.e., the effect of different network architec- 
tures. They suggest that the network connectivity, and hence 
its functionability, is robust against random failure of nodes 
0IH0] and to some extent is even robust against intentional 
attacks Here we show that for many physical net- 

works, the removal of nodes can have a much more devas- 
tating consequence when the intrinsic dynamics of flows of 
physical quantities in the network is taken into account. In a 
power transmission grid, for instance, each node (power sta- 
tion) deals with a load of power. The removal of nodes, either 
by random breakdown or intentional attacks, changes the bal- 
ance of flows and leads to a global redistribution of loads over 
all the network. This can trigger a cascade of overload fail- 
ures | I2I I13II . as the one that happened on August 10, 1996 in 
the western United Sta tes p ower grid [ lj UIsll . Another exam- 
ple is the Internet l; 16l [T where the load represents the 
amount of information a node (router) is requested to transmit 
per unit of time, and overloads correspond to congestion 1 19]. 
Internet collapses caused by congestion have been reported 
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since its very beginning 1 20] . In this Rapid Communication, 
we introduce a model for cascading failure in complex net- 
works and show that it is applicable to realistic networks such 
as the Internet and power grids. 

For a given network, suppose that at each time step one unit 
of the relevant quantity, which can be information, energy, 
etc., is exchanged between every pair of nodes and transmitted 
along the shortest path connecting them. The load at a node 
is then the total number of shortest paths passing through the 
node j2lll22ll23ll . The capacity of a node is the maximum load 
that the node can handle. In man-made networks, the capacity 
is severely limited by cost. Thus, it is natural to assume that 
the capacity Cj of node j is proportional to its initial load Ly, 

C 3 - = (l + a)Z 3 -, j — 1, 2, ...N, (1) 

where the constant a > is the tolerance parameter, and N 
is the initial number of nodes. When all the nodes are on, the 
network operates in a free-flow state insofar as a > 0. But, 
the removal of nodes in general changes the distribution of 
shortest paths. The load at a particular node can then change. 
If it increases and becomes larger than the capacity, the corre- 
sponding node fails. Any failure leads to a new redistribution 
of loads and, as a result, subsequent failures can occur. This 
step-by-step process is what we call a cascading failure, or a 
cascade. It can stop after a few steps but it can also propagate 
and shutdown a considerable fraction of the whole network 
ll24ll . A fundamental question is: under what conditions can 
such a global cascade take place? 

Here we focus on cascades triggered by the removal of a 
single node. If a node has a relatively small load, its re- 
moval will not cause major changes in the balance of loads, 
and subsequent overload failures are unlikely to occur. How- 
ever, when the load at the node is relatively large, its removal 
is likely to affect significantly loads at other nodes and pos- 
sibly starts a sequence of overload failures. Our result is the 
following: global cascades occur if (1) the network exhibits 
a highly heterogeneous distribution of loads; (2) the removed 
node is among those with higher load. Otherwise, cascades 
are not expected. The distribution of loads is in turn highly 
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correlated with the distribution of links: networks with het- 
erogeneous distribution of links are expected to be hetero- 
geneous with respect to load so that on average, nodes with 
larger number of links will have higher load 112 211 . This re- 
sult confirms the robust-yet-fragile property of heterogeneous 
networks, which was first observed in Ref. 01 for the attack 
on several nodes. The cascade effect is important, however, 
because a large damage can be caused in this case by the at- 
tack on a single node. While a network with more links can 
be more resistant against cascading failures, in practice the 
number of links is limited by cost. 

Now we provide evidence for our result. We study cascades 
triggered by random breakdown and by intentional attacks. To 
simulate the former, we choose a trigger at random among all 
the nodes of the network, as can occur in networks such as 
power grids [14]. In the case of attack the targeted node is se- 
lected from those with highest loads or largest degrees (num- 
ber of links at a node). We consider heterogeneous networks 
with algebraic (scale-free) distribution P of links, as observed 
in real systems BUSS, 

P(k) ~ k-\ (2) 

where k denotes the degree and 7 the scaling exponent, and 
compare them with an equivalent homogeneous configuration. 
These networks are generated according to the procedure in 
Refs. 1271 12811 . where the nodes are connected randomly for 
a given degree distribution, and self- and repeated links are 
forbidden. The damage caused by a cascade is quantified in 
terms of the relative size G of the largest connected compo- 
nent, 

G = N'/N, (3) 

where N and N' are the numbers of nodes in the largest com- 
ponent before and after the cascade, respectively. 

Figure^shows the relative size G of the largest component 
after cascading, as a function of the tolerance parameter a, 
for a scale-free network. We can see that on average G re- 
mains close to unity in the case of random breakdowns but it 
is significantly reduced under intentional attacks, even for a 
unrealistically large. Indeed, the size of the largest component 
is reduced by more than 20% for a = 1, i.e., for a capacity 
as large as two times the capacity required for the system to 
operate when all the nodes function normally. This result is 
in agreement with intuition, because in the case of random 
breakdown the trigger is probably one of the many nodes with 
small load, while in the case of intentional attack it is a node 
with very large load. The damage is larger for smaller val- 
ues of a, as it is for load-based attacks when compared with 
degree-based attacks. For instance, in the load-based attack 
for a = 0.2, more than 60% of the nodes are affected. For the 
5000-node networks used in our simulations, it means that a 
cascade triggered by the attack on a single node shuts down 
and disconnects more than 3000 others! 

Figure [2] shows the corresponding results for a homoge- 
neous network with the same number of nodes and exactly 
3 links per node. To make a meaningful comparison we dis- 
play in the inset results for an algebraic network with about 
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FIG. 1: Cascading failure in scale-free networks, as triggered by 
the removal of a single node chosen at random (squares), or among 
those with largest degrees (asterisks) or highest loads (circles), where 
a is the tolerance parameter and G is the relative size of the largest 
connected component. Each curve corresponds to the average over 
5 triggers and 10 realizations of the network. The error bars repre- 
sent the standard deviation. The networks are generated according 
to the algebraic distribution ^2). For the computations shown we set 
7 = 3 and 5000 < N < 5100. The average degree in the largest 
component is (k) m 2.0. 



the same average degree (actually larger, which strengthens 
our conclusions). The homogeneous network does not expe- 
rience cascading failures due either to random breakdown or 
to intentional attacks for a as small as 0.05. For the heteroge- 
neous (scale-free) network, for the same value of a, cascades 
triggered by the attack on a key node can reduce the largest 
connected component to less than 10% of the original size, 
as shown in the inset. Therefore, homogeneous networks ap- 
pear to be more robust against attacks than the heterogeneous 
ones. This conclusion does not rely on the particularities of 
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FIG. 2: Cascading failure in homogeneous networks. All nodes are 
set to have the same degree k = 3 and N = 5000. In the inset, the 
networks are generated according to the algebraic distribution J2j for 
k > 2, 7 = 3, and N = 5000. The resulting average degree is 
(k) ~ 3.1. The legends and other parameters are the same as in Fig. 
□ 
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these models, as the same was also observed for classes of 
networks with exponential and Poisson-like distributions of 
degrees (e.g., the Erdos-Renyi model 12911 '): their homogene- 
ity makes them relatively resistant to cascades triggered by 
attacks. The networks corresponding to the inset of Fig. [2] are 
generated according to the same scaling distribution of those 
in Fig. \l\ except that in this case the minimal number of links 
at a node is set to be 2. Therefore, this inset shows that the 
fragility of scale-free networks is due to their heterogeneity 
and does not rely on the presence of nodes with degree one, 
which are easily disconnectable. Naturally, the increase of the 
average degree reduces the damage of the cascade, as can be 
seen from a comparison between Fig. [Jand the inset of Fig. 
® 

Many real-world networks are heterogeneous and as such 
are expected to undergo large-scale cascades if some vital 
nodes are attacked, but rarely in the case of random break- 
down. As an example we consider the Internet at autonomous 
system level 1 30], which displays an algebraic distribution of 
links 1 3 ] . The damage caused by triggers of higher load or de- 
gree is much larger than that by random breakdown, as shown 
in Fig. [3] The cascading failures are rarely triggered by ran- 
dom breakdown for a > 0.05, but more than 20% of the nodes 
can be disconnected with the intentional attack on only one 
node for a < 0.4. We have also considered the electrical 
power grid of the western United States ll3lll . The degree dis- 
tribution in this network is consistent with an exponential 13211 
and is thus relatively homogeneous. The distribution of loads, 
however, is more skewed than that displayed by semirandom 
networks 1 271 12811 with the same distribution of links, indicat- 
ing that the power grid has structures that are not captured by 
these models. As a result, global cascades can be triggered by 
load-based intentional attacks but not by random or degree- 
based removal of nodes, as shown in Fig. |4] We see that 
the attack on a single node with large load reduces the largest 
connected component to less than a half of its initial size, even 
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FIG. 3: Cascading failure in the Internet at autonomous system level 
|30|l. The network has N = 6474 nodes and (k) « 3.88 links 
per node, on average. Each curve corresponds to the average over 5 
triggers for attacks and 50 for random breakdown. The legends are 
as defined in Fig.Q 
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FIG. 4: Cascading failure in the Western U.S. power transmission 
grid IJill . which has N = 4941 and (k) ~ 2.67. The average is 
obtained via 5 triggers for attacks and 50 for random breakdown. 
The legends are the same as in Fig.Q 



when the network is highly tolerant (e.g., a — 1). 

Our result is thus that real networks are naturally evolved 
to be quite resistant to random failure of nodes, but the pres- 
ence of a few nodes with exceptionally large load, which is 
known to be ubiquitous in natural and man-made networks, 
has a disturbing side effect: the attack on a single important 
node (one of those with high load) may trigger a cascade of 
overload failures capable of disabling the network almost en- 
tirely. Such an event has dramatic consequences on the net- 
work performance, because the functionability of a network 
relies on the ability of the nodes to communicate efficiently 
with each other. What is the use, say, of having a phone if you 
cannot call anybody? 

We conclude with some thoughts on the meaning of our re- 
sults for security. An effective attack relies on identifying vul- 
nerabilities and is far from being random. Our society is geo- 
graphically distributed in a way that natural hazards are by no 
means random 13 311 . An example is the crowding of people, 
communication, transportation, and financial centers around 
seismic areas, like the Pacific Rim. Natural disasters and in- 
tentional attacks can then have devastating consequences on 
the complex networks underlying the society. These conse- 
quences will be more severe if the damage on one or few 
nodes is capable of spreading over the entire network. In 
this sense a cascade-based attack can be much more destruc- 
tive than any other strategies of attack previously considered 
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